Sonos控制工具-免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

This is a Sonos command-line control skill whose local command and device-control behavior is mostly aligned with its stated purpose, but users should notice its broad routing text and unpinned third-party install instructions.

Install only if you intend to let an agent run Sonos CLI commands on your local network. Review and pin the npm or Python dependency before installing, avoid global installation where possible, and use the skill only for explicit Sonos device discovery, playback, volume, grouping, alarms, timers, or status requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:216

Finding

Unpinned Third-Party CLI Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 216–219
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

# Dependency instructions
npm install -g sonos-cli
# ...
# Alternatively, use the Python version
pip install soco-cli

A related dependency declaration appears at line 320:

text

| soco | Python library | Required for Python version | pip install soco |

Technical Analysis

The skill directs users or agents to install third-party packages without fixed versions, integrity hashes, lockfiles, canonical repository links, or publisher verification. Package managers will therefore resolve mutable versions from their configured registries at installation time. The npm command also installs the package globally, exposing its executables system-wide and potentially running package lifecycle scripts with the installing user's privileges.

The Python instructions are inconsistent: the installation example uses soco-cli, while the dependency table identifies and installs soco. This ambiguity increases the chance of installing an unintended or similarly named package.

No evidence establishes that the named packages are currently malicious. The confirmed weakness is that the installation process lacks controls against package compromise, malicious future releases, registry substitution, dependency confusion, or operator error.

Attack Path

1. An attacker compromises the referenced package, one of its transitive dependencies, or the relevant registry account; alternatively, a user selects an unintended package because of the inconsistent Python package names.
2. A user invokes the skill on a system where the required CLI is unavailable.
3. The agent or user follows the documented unpinned npm or pip installation command.
4. The package manager resolves the current mutable package release without verifying a project-speci ...[truncated 887 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version rather than allowing the latest registry release.
2. Provide the canonical package registry page, publisher identity, and source repository for every dependency.
3. Use integrity verification:
   • For Python, publish a requirements file with exact versions and --hash entries, then install with pip install --require-hashes.
   • For Node.js, use a local project installation and a committed lockfile with npm ci instead of a global installation.
4. Avoid npm install -g; install into an isolated project directory, container, or dedicated low-privilege environment.
5. Disable npm lifecycle scripts during installation where compatible, review package contents, and explicitly enable only required scripts.
6. Resolve the discrepancy between soco-cli and soco, documenting exactly which package supplies the claimed commands.
7. Review direct and transitive dependencies with package-manager audit and provenance tooling before approving upgrades.
8. Remove unused read or write tool permissions if they are not required, reducing the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is so broad ('提升效率、自动化流程、批量处理、工作流优化时使用') that an agent could invoke this skill for many unrelated requests. Because the skill exposes exec, read, and write capabilities and is designed to run local commands, overbroad routing increases the chance of unintended command execution and unauthorized changes to speaker state or local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents command execution against local CLI tools and network-discovered Sonos devices but does not prominently warn users that it may execute local commands and alter physical device state. Without explicit warnings and consent boundaries, users or routing logic may treat it as informational only, leading to unexpected execution, device manipulation, and potential disclosure of local network/device information.

Content

No source excerpt is available for this finding.